GDPR rights overview

Most information collected by the school about you or your child is collected on behalf of the Headteacher who is the controller of the data the school collects. This means that the Headteacher is responsible for the information being collected.

We might use your data for the following reasons:

• Where you have consented to the school using it – for example to be kept informed about school events or the computer applications your child will use in class
• Where there is a contract for the school to use it – for example where you might be hiring school equipment
• Because there is a reason in a law which means we have to collect it, under the Education Act 2001 for example
• Where we need to use or share data to protect you or your child’s vital interests
• Where it is in the public interest, or in the exercise of official authority by the headteacher

We will need to collect names, birth dates, parent/guardian details, essential information regarding health, and other information set out in the law, such as the Registration of Pupils Regulations 2016. Some schools in the United Kingdom collect very sensitive data such as thumbprints, known as ‘biometric data’ to use or pay for certain services in school. The Department nor the schools have any plans to collect or store such information, and you have the right to object to certain processing if you do not agree with it.

Schools should only collect very sensitive data (special category data) if there is a specific reason for that, which will be clearly explained to you when it is being collected. This special category data is information about race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, health, sex life or sexual orientation, and biometric information.

Primary schools will collect and store the information on a software system called Arbor. Secondary schools use a package called SIMS.

Schools should always be clear with you on how and why information is collected.

Unless there is a legal reason for us to collect, keep and use your information, or your child’s information, we will need your consent to do this. This might be for example where we are asking for helpers for a school event. 

You will be asked for consent for your child to use online applications and learning tools, such as iPads and other electronic devices. The new data protection law says that children must be asked to consent at age 13, and so children in year 8 from their 13^th birthday and upward will need to provide specific consent to us for them to continue to use those online applications. 

This does not mean that you will not be asked to give parental consent to the other uses of information in the school, children will only be required to consent for any offer of information society services from this age.

If we need your consent, you can withdraw this consent at any time.  We may still use your information if there is a legal reason. We also need to be able to prove that we have consent, which may sometimes mean that you are asked to confirm in writing by signing a form or returning a slip to school.

Information we hold about you or your child can be requested by contacting the school directly, or the Department’s Data Protection Officer. Details of the necessary contacts are on the school’s website and on the Government’s website. Certain information may not be legally required to be disclosed to you, but otherwise, the information will be provided within one month of your request, at no charge.

In replying to any request you make, an explanation on how long the information is kept for, how you might access or ask for it to be destroyed or restrict processing will be given. We will also tell you where we have obtained the information from if this is not from you. We will also point out that you may withdraw your consent (if the processing of your information is being done because you have given your consent and not for any other legal reason), and also your right to complain to the regulator, namely the Information Commissioner in the Isle of Man. The Information Commissioner can be contacted by phoning 01624 693260, emailing ask@inforights.im or writing to:

The Information Commissioner,
First Floor,
Prospect House,
Prospect Hill,
Douglas,
Isle of Man
IM1 1ET

Some information about your child will be shared with other public sector organisations, for example to plan and administer swimming lessons, or cycle proficiency training.

Information may also need to be shared within the school, between teachers or department heads, and also with other support and administrative staff.  In some circumstances, information will be provided to the Department of Education, Sport and Culture, for example in the reporting of pupil progress or quality assurance, and in provision of special educational needs education. 

Information will only be shared with people who need access to it to carry out their jobs, and only the information they need for that purpose will be shared.  Information is stored in the Arbor and SIMS systems as above. The information is only ever kept on servers within Europe (for example SIMS servers are based on the Island).

Schools may sometimes use social media (Facebook, Twitter or other social media) to announce special awards or achievements, with your consent. If you do not wish for this to happen you can inform the school, or make a request to remove any announcements that concern your child. In all cases, only very limited personal information will be shared online.

Pupil records are kept by [the school/Department] until the young person reaches 25 years old. You also have the rights to:

• Ask us to correct information, or delete it if we don’t need it or if it shouldn’t have been collected
• To object if you think that we don’t have a legal reason to use or keep information about you or your child
• To ask that we restrict processing to one purpose (unless we have legal reasons to use it for other reasons)
• To ask that your child’s records are sent in an electronic and easy to use format to any new school
• Object to automated processing – although there is no automated processing in schools in the Isle of Man, all processing has some form of human intervention
• Complain to the Information Commissioner, or take court action for complaints relating to use of information by the school

Bear in mind that sometimes we will have legal reasons for keeping the data, and that in some circumstances, for example the admissions register will be kept for a long time (25 years) and then passed to the Public Records Office who have legal powers to permanently preserve some documents as public records.  There may also be restrictions to the rights above, where there is a legal reason or power to hold certain information, or where there is legal action ongoing, or conflict with other laws or rights. We will explain any restrictions if you make any requests.

This is a summary of the relevant rights in relation to personal data held by schools in the Isle of Man. If you wish to, you may wish to consult our guide setting out a detailed description of the various rights, which are set out in full and can be downloaded from the link on this page. If you need more information you should contact the school Headteacher in the first instance, or the Data Protection Officer for the Department of Education, Sport and Culture at:

Department of Education, Sport and Culture,
Corporate Services Division,
Thie Slieau Whallian,
St John's,
Isle of Man,
IM4 3AS

Tel: 01624 685808
Email: mailto:DPO-DESC@gov.im

Although they can’t give you advice, they may be able to help you with your enquiry or provide the information you need.

You may wish to ask for further advice if you have any difficulties with the use of your information or your child’s information, as this is only a short guide for parents.